Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 3 / 51
Desks: 9

Data graphic: Snort 3 at the centre of Cisco's products, with Meraki MX and cloud services auto-patched and Secure Firewall Threat Defense, Cyber Vision and IOS XE UTD needing upgrades

Cisco Rates Its Snort 3 Fixes 9.0: Secure Firewall, Meraki MX and IOS XE UTD Need Updates

Cisco patched four Snort 3 CVE groups, two scored 9.0. Cloud and online Meraki MX are fixed; FTD, Cyber Vision and IOS XE UTD need upgrades.

Oct 27 · 3 min

Data graphic: CVE-2026-111497 in the Node.js Brotli decoder, stamped CVSS 9.2, with fixed versions 22.23.4, 24.22.1 and 26.12.1

highExploits Cve 2026 111497

Node.js patches Brotli decoder out-of-bounds write CVE-2026-111497

Malformed Brotli input can overflow an 8-byte buffer in Node.js's node:zlib decoder. Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497.

Oct 27 · 3 min

Data graphic: Claude Code compacts conversations of 200K tokens or more after about 54 minutes idle, before the one-hour prompt cache expires

watchResearch Claude Code

Claude Code Now Compacts Idle Sessions Before the Cache Expires: What Changes for Pro and Max Limits

Claude Code now compacts idle 200K-token sessions before the prompt cache expires and warns Pro and Max users before costly resumes. Here is what changed.

Oct 27 · 4 min

Data graphic: standard API price per million input plus output tokens: GPT-6 Luna $0.60, GPT-6.1 Terra $6.00, GPT-6.1 Sol $12.00, GPT-6 Astra $60.00.

watchResearch Gpt 6 1 Terra

GPT-6.1 Terra arrives in Codex, ChatGPT Work and GitHub Copilot at half the API price of Sol

OpenAI's GPT-6.1 Terra is in Codex, ChatGPT Work and Copilot, and costs $1/$5 per million tokens on the API: half of Sol, a tenth of Astra.

Oct 27 · 4 min

Data graphic: poster headed "What free home design apps carry", with a large 9 for the tracker SDKs in Planner 5D Exodus scan, 6 October 2026 . Smaller figures: magicplan's 10 dangerous or special permissions, 167 FloorGen guest-session requests with 2 to an outside host, and no trackers in Live Home 3D's October 2025 scan.

stableData Security Floorgen

Free Home Design Software: The Trackers and Permissions Behind the Apps

We checked seven popular Android home design apps for tracker SDKs, permissions and data-safety claims, then put a browser editor through the same test.

Oct 26 · 10 min

Data graphic: A CVSS score of 10.0 for CVE-2026-10134, an unauthenticated RCE in Langflow 1.0.0 to 1.9.3, under the headline "Langflow, one module away": Metasploit has added six Langflow modules with exploit code for versions below 1.12.3. Upgrading to 1.12.3 or later covers CVE-2026-10134, but the two Zero Day Initiative bugs, CVE-2026-0768 and CVE-2026-0769, have no documented fix, so the advice is to take Langflow off the open internet, then upgrade.

highAI Security Langflow

Metasploit Adds Six Langflow Modules, Including a CVSS 10.0 Unauthenticated RCE

Rapid7 added six Langflow modules to Metasploit, including CVSS 10.0 CVE-2026-10134. Upgrade to 1.12.3 or later and take Langflow off the open internet.

Oct 24 · 4 min

Data graphic: file sizes in GB weights only for Sage-A1.5 Q4_K_M 21.7 GB and six Ornith quants, shown against shaded 32 GB and 128 GB machine zones. Sage fits a 24 GB card, while Ornith-1.5-122B starts at 40.4 GB, bigger than a 32 GB machine, and needs the 128 GB class; its Q8_0 file at 132.6 GB is 4.6 GB past the 128 GB line.

watchResearch Open Weight Coding Models

Ornith-1.5-122B vs Sage-A1.5: Which Open Coding Model Fits Your 16, 24, 32 or 128 GB Machine

Sage-A1.5 fits a 24 GB card at 21.7 GB; Ornith-1.5-122B's smallest quant is 40.4 GB. The cards' 17-point SWE-bench Pro gap is a size mix-up.

Oct 24 · 5 min

Data graphic: "Stolen keys, rented agents" shows how MONST3R-AI works: a stolen OpenAI, Anthropic or Google API key goes into a bring-your-own-key panel, the buyer sets the budget cap and target list, an autonomous scan runs with safety training bypassed, and the bill lands on the key owner, who pays. Beside it: 800+ fake AI-skill and MCP repos in the FakeGit campaign of 7,600 GitHub repos pushing SmartLoader, the seller's unverified claim of 1,072 findings across 199 hosts, and a 67% rise in forum talk of MCP and AI agents across 16 forums, Feb to Aug 2026.

elevatedAI Security Llmjacking

MONST3R-AI Rents Out Autonomous Pentests on Stolen OpenAI, Anthropic and Google Keys

Bitsight found MONST3R-AI, a pentest agent that runs on stolen OpenAI, Anthropic and Google API keys, as 800+ fake AI-skill and MCP repos push SmartLoader.

Oct 24 · 5 min